Essential 8 Self-Assessment

The execution of executables, software libraries, scripts, installers, compiled HTML, HTML applications and control panel applets are:

Application control is implemented on:

Allowed and blocked executions on workstations:

Microsoft’s ‘recommended block rules’ are implemented

Microsoft’s ‘recommended driver block rules’ are implemented.

Application control rulesets are validated on an annual or on defined schedule period.

Patches, updates or vendor mitigations for security vulnerabilities in internet-facing services are applied within two weeks of release, or within 48 hours if an exploit exists: (i.e. LOB Applications i.e. CRM, Accouting software, etc.)

Patches, updates or vendor mitigations for security vulnerabilities in office productivity suites, web browsers and their extensions, email clients, PDF software, and security products are: (i.e. Word, Excel, PowerPoint, PDF editor, Chrome or other web browsers, etc.)

Patches, updates or vendor mitigations for security vulnerabilities in other applications are applied within one month.

A vulnerability scanner is used daily to identify missing patches or updates for security vulnerabilities in internet-facing services.

A vulnerability scanner is used to identify missing patches or updates for security vulnerabilities in office productivity suites, web browsers and their extensions, email clients, PDF software, and security products

A vulnerability scanner is used at least fortnightly to identify missing patches or updates for security vulnerabilities in other applications.

Internet-facing services, office productivity suites, web browsers and extensions, email clients, PDF software, Adobe Flash Player, and security products that vendors no longer support are removed.

Microsoft Office macros are disabled for users that do not have a demonstrated business requirement.

Microsoft Office macros in files originating from the internet are:

Microsoft Office macro antivirus scanning is enabled.

Microsoft Office macro security settings:

Microsoft Office macros are blocked from making API calls.

Only Microsoft Office macros running from within a sandboxed environment, a Trusted Location, or digitally signed by a trusted publisher are allowed to execute.

Only privileged users responsible for validating that Microsoft Office macros are free of malicious code can write to and modify content within Trusted Locations

Microsoft Office macros digitally signed by an untrusted publisher:

Microsoft Office’s list of trusted publishers is validated on an annual or more frequent basis.

Allowed and blocked Microsoft Office macro executions are:

Web browsers:

Web browsers do not process web advertisements from the internet.

Internet Explorer 11:

Web browser security settings:

Microsoft Office is blocked from creating child processes

Microsoft Office is blocked from creating executable content.

Microsoft Office is blocked from injecting code into other processes.

Microsoft Office is configured to prevent the activation of OLE packages.

PDF software is blocked from creating child processes.

ACSC or vendor hardening guidance for web browsers, Microsoft Office, and PDF software is implemented.

Blocked PowerShell script executions:

.NET Framework 3.5 (including .NET 2.0 and 3.0) is disabled or removed.

Windows PowerShell 2.0 is disabled or removed.

PowerShell is configured to use Constrained Language Mode.

Requests for privileged access to systems and applications are validated when first requested:

Privileged access to systems and applications is automatically disabled after 12 months unless revalidated.

Privileged access to systems and applications is automatically disabled after 45 days of inactivity.

.Privileged access to systems and applications is limited to only what is required for users and services to undertake their duties

Privileged accounts (excluding privileged service accounts) are prevented from accessing the internet, email and web services.

Privileged users use separate privileged and unprivileged operating environments.

Privileged operating environments:

Unprivileged accounts cannot log on to privileged operating environment.

Privileged accounts (excluding local administrator accounts) cannot log on to unprivileged operating environments.

Just-in-time administration is used for administering systems and applications.

Administrative activities are conducted through jump servers.

Credentials for local administrator accounts and service accounts are unique, unpredictable and managed.

Windows Defender Credential Guard and Windows Defender Remote Credential Guard are enabled.

Use of privileged access is:

Changes to privileged accounts and groups are:

Patches, updates or vendor mitigations for security vulnerabilities in operating systems of internet-facing services are applied within two weeks of release, or within 48 hours if an exploit exists.

Patches, updates or vendor mitigations for security vulnerabilities in operating systems of workstations, servers and network devices are:

A vulnerability scanner is used at least daily to identify missing patches for security vulnerabilities in operating systems of internet-facing services.

A vulnerability scanner is used to identify missing patches for security vulnerabilities in operating systems of workstations, servers and network devices:

The latest release (or the previous release) of operating systems are used for workstations, servers and network devices.

Operating systems that vendors no longer support are replaced.

Your organisation’s users use Multi-factor authentication/2FA if they authenticate to their organisation’s internet-facing services.

Your organisation’s users use Multi-factor authentication/2FA if they authenticate to third-party internet-facing services that process, store or communicate their organisation’s sensitive data.

Your organisation’s users use Multi-factor authentication/2FA (where available) if they authenticate to third-party internet-facing services that process, store or communicate their organisation’s non-sensitive data.

Multi-factor authentication/2FA is enabled by default for non-organisational users (but users can opt out) if they authenticate to an organisation’s internet-facing services.

Multi-factor authentication/2FA is used to authenticate privileged users of systems.

Multi-factor authentication/2FA uses:

Successful and unsuccessful multi-factor authentications/2Factor authentications:

Backups of critical data, software and configuration settings are performed and retained in a coordinated and resilient manner per business continuity requirements.

Restoration of systems, software and essential data from backups is tested in a coordinated manner as part of disaster recovery exercises.

Unprivileged accounts:

Unprivileged accounts: